With both Basic and Anonymous authentication, the user's logon credentials are cached on IIS for 15 minutes. If you make a change to the user's password, and the user has logged onto IIS within the 15 minutes of the password change, IIS will accept the old password until the cache is updated. This problem can also appear if you add a user to a group and their group memberships are not updated until the cache is refreshed. You can force a cache update by stopping and starting IIS.
IIS caches these credentials (Basic and Anonymous authenticated users) to improve performance. If the cache were not present, authentication would need to reoccur with every access, which could significantly reduce performance.